Description
The WebSocket functionality in Storybook’s dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability only affects the Storybook dev server; production builds are not impacted.
Recommendation
Update the storybook package to the latest compatible version. Followings are version details:
Affected version(s): **>= 10.0.0-beta.0, < 10.2.10 >= 8.7.0-alpha.0, < 9.1.19 >= 8.1.0, < 8.6.17** Patched version(s): **10.2.10 9.1.19 8.6.17**
References
Could your website be exposed too?
SmartScanner can check your website for Storybook Dev Server is Vulnerable to WebSocket Hijacking and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Storybook dev server vulnerable to code injection from the local network - CVE-2026-114126
- Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability - CVE-2026-44211
- fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding - CVE-2026-75899
- fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization - CVE-2026-75975
You might also like:
See something that needs correcting? Let us knowUpdated February 26, 2026